PT-2018-4228 · Oxid · Oxid Eshop Professional Edition+2

Cesnauskast · Publicado 2018-01-19 · Atualizado 2021-01-20 · CVE-2014-4919

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions OXID eShop Professional Edition versions 4.7.13 and earlier, 4.8.x before 4.8.7 OXID eShop Enterprise Edition versions 5.0.13 and earlier, 5.1.x before 5.1.7 OXID eShop Community Edition versions 4.7.13 and earlier, 4.8.x before 4.8.7

Description The issue allows remote attackers to assign users to arbitrary dynamical user groups.

Recommendations For OXID eShop Professional Edition versions 4.7.13 and earlier, update to version 4.7.13 or later. For OXID eShop Professional Edition version 4.8.x before 4.8.7, update to version 4.8.7 or later. For OXID eShop Enterprise Edition versions 5.0.13 and earlier, update to version 5.0.13 or later. For OXID eShop Enterprise Edition version 5.1.x before 5.1.7, update to version 5.1.7 or later. For OXID eShop Community Edition versions 4.7.13 and earlier, update to version 4.7.13 or later. For OXID eShop Community Edition version 4.8.x before 4.8.7, update to version 4.8.7 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-4919

Produtos afetados

Oxid Eshop Community Edition

Oxid Eshop Enterprise Edition

Oxid Eshop Professional Edition

Referências · 5

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4919 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-4919 · Nota de Segurança
• https://t.me/cvenotify/8727 · Publicação no Telegram
• https://bugs.oxid-esales.com/view.php?id=5814 · Aviso do Fabricante
• https://oxidforge.org/en/security-bulletin-2014-003.html · Aviso do Fabricante